Contributions
Osc_Sec
A security script design as a workaround for the following common security holes.
http://www.exploit-db.com/exploits/15472/
http://www.securityfocus.com/bid/9211/exploit
http://tinyurl.com/osc-hack3
http://www.exploit-db.com/exploits/15472/
http://www.exploit-db.com/exploits/15128/
Also allows (optional) options to ban a range of dictionary hammering applications that do not understand cookies.
Has a function to add IP addresses automatically to a banned list htaccess file if the user breaks the rules.
Expand All / Collapse All
The final (latest) release of osC_Sec can be found here:
http://addons.oscommerce.com/info/8283
Due to it being significantly different than the first release I felt it best reload it again with a new updated description
Whats New?
- Update to additional htaccess code to catch local file includes and session hijacking attempts
- Update to getShield and databaseShield filter lists
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Updating:
If you are upgrading from version 4.2[r6] and earlier then please replace both the osc_sec.php and osc.php files in your website /includes/ directory with the osc_sec.php and osc.php files in the includes directory of this zip file.
If updating from 4.2[r7] then all you need do is replace the osc_sec.php file in your catalogs /includes/ directory with the one in the /includes/ directory of this zip file.
Please report any bugs to the discussion forums at http://goo.gl/dQ3jH or email rohepotae@gmail.com
Whats New?
- Removed double up entries in the bypass function
- Added a filter to look specifically for osCommerce admin login bypass attempts. Unlike other filters, no requests or files are exempt from this filter.
- (re)Added a x_powered_by() function to overwrite the apache response header with a custom string to prevent automated attacks from identifying what version of PHP your site is hosted on if expose_php is enabled in the php.ini
- Added an option to disable the tell_a_friend.php page and therefore prevent it from being used to send spam (see readme.htm).
- Fixed issue with the emailer when IP Trap is enabled.
- Optional code additions for htaccess to further harden the security of your website.
- Added a check for the multi-byte GBK character
- Added a Local File Inclusion filter to prevent PHP stream php://filter LFI exploit attempts
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Updating: Replace both the osc_sec.php and osc.php files in your website /includes/ directory with the osc_sec.php and osc.php files in the includes directory of this zip file.
Please report any bugs to the discussion forums at http://goo.gl/dQ3jH or email rohepotae@gmail.com
Whats New?
- Cleanup of excess code and functions no longer used
- Removed ip bypass list from the oscSecBypass() function
- Further work on the getShield() function
- Update to instructions in readme.htm
- Faster HTTPS check
- osC_Sec's osc_sec.php can now work as a standalone file for users who have multiple websites and use the default settings
- Fixed an issue with Sitemonitor so that osC_Sec bypasses Sitemonitor files correctly
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Updating: Replace the osc_sec.php file in your website includes directory with the osc_sec.php file in this zip file.
Please report any bugs to the discussion forums at http://goo.gl/dQ3jH or email rohepotae@gmail.com
Whats New?
- removed the header( "X-Powered-By: osC_Sec" ); code as it causes some errors on some server configurations and conflicts with other addons.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Updating: Replace the osc_sec.php file in your website includes directory with the osc_sec.php file in this zip file.
Please report any bugs to the discussion forums at http://goo.gl/dQ3jH or email rohepotae@gmail.com
Whats New?
# Removal of $osCSpamTrap from osC_Sec.
In order for $osCSpamTrap to work most effectively and securely it must be included further down the application_top.php page. Therefore I have decided to remove it from osC_Sec and will be releasing it shortly as a stand-alone addon.
# Fixed an error with the IP Trap code
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Updating: Replace both the osc_sec.php and osc.php files in your website includes directory with the osc_sec.php and osc.php files in this zip file.
Please report any bugs to the discussion forums at http://goo.gl/dQ3jH or email rohepotae@gmail.com
Whats New?
- Fixed code error in check_ip() function
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Updating: just replace the osc_sec.php in your website includes directory with the osc_sec.php file in this zip file.
Please report any bugs to the discussion forums at http://goo.gl/dQ3jH or email rohepotae@gmail.com
Whats New?
- updates to $osCSpamTrap
- added a 'X-Powered-By: osC_Sec' header to inflict fear into the hearts of would be exploiters
- more updates to the mysql injection detection script
- fixed an error with the $spiderBlock code
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Updating: just replace the osc_sec.php in your website includes directory with the osc_sec.php file in this zip file.
Please report any bugs to the discussion forums at http://goo.gl/dQ3jH or email rohepotae@gmail.com
Whats New?
- More updates to getRealIP() and check_ip() functions
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Updating: just replace the osc_sec.php in your website includes directory with the osc_sec.php file in this zip file.
Please report any bugs to the discussion forums at http://goo.gl/dQ3jH or email rohepotae@gmail.com
Whats New?
- Added additional checks in the getRealIP() function
- Fixed print issues with the email notification
- Removed an item from the cookieshield blacklist that could cause false positive results
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Updating: just replace the osc_sec.php in your website includes directory with the osc_sec.php file in this zip file.
Please report any bugs to the discussion forums at http://goo.gl/dQ3jH or email rohepotae@gmail.com
Whats New?
Finally got around to developing out the check_ip() and getRealIP() functions.
- check_ip() can now test the format of both IPv4 and IPv6 ip addresses.
- getRealIP() has been modified to better handle proxy servers
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Updating: just replace the osc_sec.php in your website includes directory with the osc_sec.php file in this zip file.
Please report any bugs to the discussion forums at http://goo.gl/dQ3jH or email rohepotae@gmail.com
Whats New?
Fixed a bug in the $osCSpamTrap. The aspect of $osCSpamTrap which monitors the admin directory has now been restricted to version 2.3.1
The best security for your admin directory is to firstly upgrade to version 2.3.1. Failing that it is best you use htaccess basic user authentication. You can also renamed the directory as well.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Updating: just replace the osc_sec.php in your website includes directory with the osc_sec.php file in this zip file.
Please report any bugs to the discussion forums at http://tinyurl.com/oscsec or email rohepotae@gmail.com
### REMINDER: For those updating, this will need to be a full reinstall as #BOTH# files need replacing ###
Whats New?
1/ osC_Sec has been rewritten as a PHP 4.x backward compatible class, so it is important that you replace both files in the includes directory with the two files in this zip file. That also means you will need to redo the settings in osc.php as well.
2/ $nonGETPOSTReqs now bans IP addresses (if ip banning is activated) of requests that are neither GET, POST, OPTIONS or HEAD
3/ Fixed an issue where dbShield might miss a critical database injection attempt
4/ Fixed an error in the postShield code
5/ dbShield() now checks _GET variables for base64 encoded strings
6/ Update to the getShield to better catch attempts to include malicious file content
7/ Improvement to the osCSecBypass() function
8/ The diagnostics email function has been removed now as it is no longer needed
9/ Fixed an error in the email notification script concerning multidimentional arrays
Please report any bugs to the discussion forums at http://tinyurl.com/oscsec or email rohepotae@gmail.com
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
### REMINDER: For those updating, this will need to be a full reinstall as #BOTH# files need replacing ###
Whats New?
1/ osC_Sec has been rewritten as a PHP 4.x backward compatible class, so it is important that you replace both files in the includes directory with the two files in this zip file. That also means you will need to redo the settings in osc.php as well.
2/ $nonGETPOSTReqs now bans IP addresses (if ip banning is activated) of requests that are neither GET, POST, OPTIONS or HEAD
3/ Fixed an issue where dbShield might miss a critical database injection attempt
4/ Fixed an error in the postShield code
5/ dbShield() now checks _GET variables for base64 encoded strings
6/ Update to the getShield to better catch attempts to include malicious file content
7/ Improvement to the osCSecBypass() function
8/ The diagnostics email function has been removed now as it is no longer needed
9/ Fixed an error in the email notification script concerning multidimentional arrays
Please report any bugs to the discussion forums at http://tinyurl.com/oscsec or email rohepotae@gmail.com
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
1/ osC_Sec no longer supports the Security Pro whitelist code. $GETcleanup has been removed from the new updated version of osC_Sec. If you want whitelisting then it is best you install FWR MEDIA Security Pro 2.0
2/ Fixed a number of issues with the dbShield that could result in false positive bans
3/ Update to email notification
4/ Added items to the blacklists to catch malware include attempts
* For those updating, this will need to be a full reinstall sorry as both files need replacing.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
1/ osC_Sec no longer supports the Security Pro whitelist code. $GETcleanup has been removed from the new updated version of osC_Sec. If you want whitelisting then it is best you install FWR MEDIA Security Pro 2.0
2/ Fixed a number of issues with the dbShield that could result in false positive bans
3/ Update to email notification
4/ Added items to the blacklists to catch malware include attempts
* For those updating, this will need to be a full reinstall sorry as both files need replacing.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- More work on the dbShield() to prevent false positives and catch more injection attempts
* For those updating, replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- More work on the dbShiled() to prevent false positives
* For those updating, replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Code cleanup
- Tweaked the flood protection settings in $osCSpamTrap
- More additions to the database Shield
- dbShield() now checks all server requests for sql injection attempts
* For those updating, replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Fixed an issue where code had become wrapped
- Removed a getShield blacklist item that could cause a false positive
- More hardening of the SQL Injection protection
* For those updating, replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Updated the file injection section
- Removed blacklist items that clash with the way some addons use GET instead of POST as a method of processing input data in forms.
- Added the Quickpay 3rd party payment addon to the IPBypass code
- The ban bad spiders feature is now optional for new installs
- Fixed a bug in the IP address detection code
* For those updating, replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Fix to cookie logout code for $osCSpamTrap
- Addition code added to catch advanced database injection attempts aimed at bypassing web application whitelist filtering and webserver firewalls
* For those updating, replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Added blacklist items
- Small fix to $osCSpamTrap code
* For those updating, replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Code cleanup.
- Added a function to blacklist bad web harvesters
- Addressed an issue that could lead to a loop in some server configurations
* For those updating, replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Small code change.
* For those updating, replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Fix to the session.use_only_cookies code
- Moved the scubGET function to the osc.php file
* FOR THOSE UPDATING, replace BOTH the osc.php and osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- New additions to the bypass() function to include all files in the ext/modules/payment
* For those updating, replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Added flood protection to the $osCSpamTrap beta test feature.
- Removed the $chkPostLocation function as it is causing too many conflicts
- Further enhancements of $PHP_SELF code
* For those updating, replace both osc.php and osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
- Updates to the blacklists
* For those updating, just replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- more updates to the delete cookies and sessions aspect of the osCSpamTrap test feature
- access denied is now called if the x-forwarded-for source IP is malformed
* For those updating, just replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Fix to a number of minor issues with $osCSpamTrap test code
* For those updating, just replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Fix to admin sessions cookie not being destroyed under certain circumstances when $osCSpamTrap is enabled
- $chkPostLocation now throws an access denied message and calls a page die when data is attempted to be posted from an external source, rather than adding the IP to the ban list as it previously did if IP banning is enabled.
- Update to getShield to improve the way it deals with request uri strings
* For those updating, just replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Fix to admin sessions cookie not being destroyed under certain circumstances when $osCSpamTrap is enabled
- $chkPostLocation now throws an access denied message and calls a page die when data is attempted to be posted from an external source, rather than adding the IP to the ban list as it previously did if IP banning is enabled.
- Update to getShield to improve the way it deals with request uri strings
* For those updating, just replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Just a quick small change to previous update.
* For those updating, just replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Improvement for $osCSpamTrap removal of sessions and cookies
- More checks of non-standard server request types
- Removed the inJECTorChk function as it is not needed
* For those updating, just replace the osc_sec.php file in includes/ with the one in this package.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Added a list of files to the ipBypass exclusion list including the range of sitemonitor files and some payment processor callback files.
- Added a version checker to restrict certain features depending on which version of osCommerce being used
* For those updating, you will need to replace both osc_sec.ph and osc.php files.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- $osCSpamTrap now cleans up its sessions on log off
- Update to the $PHP_SELF code
- Added another function to increase effectiveness of $chkPostLocation feature in preventing the posting of data from unauthorised forms
For those updating, just replace the osc_sec.php file.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Update to blacklists
- Fixed issues in $osCSpamTrap which can cause logouts in some versions of osCommerce if activated
- If activated, the session timeout for $osCSpamTrap is set to 60 minutes
For those updating, just replace the osc_sec.php file.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Update to blacklists
For those updating, just replace the osc_sec.php file.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Small change to the email layout
For those updating, just replace the osc_sec.php file.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Updated Blacklists
- Update to the way $PHP_SELF is set
- Fix to getShield, postShield and cookieShield
- Updated the email notification
- Added more server variables to sessions to make them more unique to each visitor
For those updating, just replace the osc_sec.php file.
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- general cleanup of all the code
For those updating, please replace both osc.php and osc_sec.php (reminder to add in your own settings again to osc.php).
New Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Added the $osCSpamTrap function (see readme.htm)
- Update to blacklists
- Update to mailer code
- Fixed glitch in IP Trap code
- Fixed glitch in 2.3.1 $PHP_SELF code
- Fix to the getDIR() function
- Streamline the cookieShield function
- Expire Cookie option has been removed due to too many conflicts with various versions of osCommerce
This is a complete update and both osc.php and osc_sec.php files need to be updated. Don't forget to reset your settings in osc.php
Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Code cleanups
- Strengthened the hashing methods for cookie sessions
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- cookieShield now has its own blacklist
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Cookies are now tested against the blacklists
- Removed excess code which caused a double up in the email notification
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm, as per usual, all updates contain the complete package
Whats New?
- Small fix to email disabler code to remove error notice
- Cleanup of global code
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Auto disable the emailer if either the htaccess file is not writable or htaccess banning is disabled
- More updates to blacklists
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Updated blacklists
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Updated expired cookie ini_get code
- Updated the way the visitor IP address is detected
- Updated the injection checks
- getShield now searches the Request_Uri rather than Query_String
- postShield now decodes all post inputs before testing against the blacklist
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Further fine tuning of the code for determining the visitors IP address when the server is proxied in a cluster/cloud.
- Update to banned request_uri and query_string code
- Updated several items from the GET blacklist that can cause false positive results
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Refined the code for determining the visitors IP address when the server is proxied in a cluster.
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Removed the trim aspect of the email notification
- Added more items to GET and POST blacklists
- Fixed an issue with $_SERVER[ "REMOTE_ADDR" ] reporting the IP address of the server in front of one the website is hosted on when hosted in server clusters.
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Fixed an issue with $httphost when the site URL is a subdomain
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Changed the way $httphost is set
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Fixed issues with $_GET arrays
- Cleanup readme.htm to reflect new code in osc.php
- Fixed code in email section
- Fixed bug in $chkPostLocation
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Fix to bug in register globals code
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Same as previous upload, just with one small non-critical addition to settings in osc.php
Whats New?
- Add checks for servers that have register_globals enabled
- Now checks that $_GET is always an array
- Fixed an issue in the coding that caused a redirect to the index.php rather than a ban
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Script clean up of the way osC_Sec detects the cookie settings
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Fine tuning of the postShield black list to allow for file editting via file managers and language editors.
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Removed the referer check test for $chkPostLocation which was causing issues for sites behind https
- Removed the ban aspect of $testExpiredCookie which now calls a 403 page ban and page die
- Due to session conflicts in osCommerce versions 2.2.x and the $testExpiredCookie, osC_Sec now disables $testExpiredCookie with those versions
- Optional change in the location of the require_once() include in both application_top.php files (see readme.htm for new location) for where osC_Sec is included
To update just replace the osc_sec.php file in your includes directory
Install instructions: see the readme.htm
Whats New?
- Constructed a better method of determining the catalog directory
- Better method of determining the domain cookie string
- When someone tries to directly access osc_sec.php, a page not found message is now displayed
- Full range of Paypal IP addresses added.
- Fixed issue with htaccess corruptions under certain conditions
Update Instructions: Please update both osc.php and osc_sec.php in this update thanks. This will obviously mean resetting the settings in osc.php
Install instructions: see the readme.htm
Whats New?
- removed the reverse check on POST requests to lighten the server load.
- corrected syntax in malformed request string
- $testExpiredCookie is now set by default to disabled in new installs of osC_Sec
- added more blacklist items
Update Instructions: copy the osc_sec.php file to your includes directory and overwrite the current file. No need to update the settings file osc.php
Install instructions: see the readme.htm
Whats New?
- Fixed the test cookie function. It now bans correctly if an expired cookie is returned.
A note about this cookie function. If activating this function causes session errors to appear on your site then disable it.
Its purpose is to catch bots often used to havest information from websites that will later be used to exploit those sites.
Although most reputable search spiders are programmed in a way that emulated a web browser so therefore will not return an expired cookie as a proper web browser should act, it is still possible to catch some legitimate web spider servers in this net.
No legitimate site visitors will be banned though since all web browsers with cookies activated are set to not return an expired cookie.
Update Instructions: copy the osc_sec.php file to your includes directory and overwrite the current file. No need to update the settings file osc.php
Install instructions: see the readme.htm
Whats New?
- Added a section in osc.php to put the full address to the blocked.php if you use $useIPTRAP. If you use ipTrap then you need to configure this in osc.php in order for osC_Sec to work correctly with ipTrap.
- Removed $abitrarysession_block section because it caused too many errors on sites with certain configurations
- osC_Sec now checks in both upper and lower case for attack vectors
- Optional: Updated the way $PHP_SELF is set in the application_top.php (see readme.htm)
NOTE: With this upgrade you will need to update both osc.php and osc_sec.php.
Whats New?
- Refined the GET blacklist to list only items that are being used against osCommerce websites
- Check of the http request type no longer bans non-whitelisted items but rather just denies the request
- General cleanup
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Fixed issue with phpSelfFix
- Fixed issues with IPTrap function
- Fixed issues with scrubGET
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Fixed issue with phpSelfFix
- Fixed issues with IPTrap function
- Fixed issues with scrubGET
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Added a check for magic quotes
- Banned a few SQL injection and malicious moz-binding strings
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Clean up of ban reasons
- Fixed the expired cookie browser test
- Added more GET request banned items
- Fixed a bug in the blacklists that could cause a ban of a legitimate site request
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Clean up of ban reasons
- Fixed the expired cookie browser test
- Added more GET request banned items
- Fixed a bug in the blacklists that could cause a ban of a legitimate site request
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Further refinement of the phpSelfFix() function to allow bans as a priority to redirecting to the correct page.
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Ignore previous, it has a bug in it.
Whats New?
- A fix up of the IP Trap interaction
- Added code to deal with register_globals vulnerabilities
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- A fix up of the IP Trap interaction
- Added code to deal with register_globals vulnerabilities
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Fixed issues with the way osC_Sec interacts with IP Trap
- osC_Sec diagnostic email will now only send if you have either IP Trap or htaccess banning enabled. This is to reduce the amount of repeat emails I receive.
- Added the server request uri and request method to the dianostic email.
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Added most POST and GET blacklist items
- Fixed the way getShield deals with base64 encoded items
- Removed items from the POST blacklist that could potential result in an incorrect ban
- Fixed postShield issue when hex code is found in post data but is not on the blacklist
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Repaired an issue with the way the email notification reported the hack attempts.
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Fixed an issue where the phpSelfFix function might interfere with some configurations of SEO URLs.
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Set $banipaddress and $emailenabled in osc.php by default to disabled.
- Fix up of scrubster function
- Added feature to test post strings in reverse against the blacklist
- Removed the REQUEST filtering as this is aptly covered in POST and GET
- Rewrite of much of the main sections moving much of the code into functions
- Removed the emtee() function as it is not needed
- osC_Sec now checks for reversed malicious GET request strings
- Further refinement of the GET filtering (based closer the FWR_MEDIAs concept with additions)
- Fine tuning of the way $PHP_SELF is set.
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
This will be the final update for osC_Sec (barring any discovered bugs)
Whats New?
- Removed htaccess warning when htaccess file is not writable.
- Added blacklist items to the GET request list
- Changed the IP address locator to http://en.utrace.de/whois/
- Added more Paypal IP addresses to the whitelist
- Allowed OPTIONS request type in the requests whitelist
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Added more blacklisted items to the $_POST blacklist that would only appear in attempts to post malware code
- Removed a number of items from the $_POST blacklist that could cause a ban under certain normal conditions
NOTE: With this upgrade you will NOT need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- updated the GET whitelist recursive function to check for arrays where strings should be
- moved items from the REQUEST blacklist to the GET blacklist
- added code change instructions to the readme.htm which will assist in securing the admin login in version 2.2.x of osCommerce
NOTE: With this upgrade you will not need to update osc.php. Just replace the osc_sec.php in this package with the one on your site and you are up to date.
Whats New?
- Fixed error notices about $getHexvars
- Tidy up of $arbitrarysession_block
- Better prevention code of directly viewing of osc.php and osc_sec.php
- Auto set PHP error notices to off
- Fixed bug in $chkPostLocation where if activated, whitelisted IPs were still being blocked from free posting without referers or cookies preset.
- Changes to the GET whitelist filter to assist it to allow unicode through
- Set up a workaround to set the DIR_FS_CATALOG constant correctly where it is missing a trialing forward-slash
NOTE: With this upgrade you will need to update both osc.php and osc_sec.php
Whats New?
- GET cleanup now better presents special characters
- Added the osC_Sec version to the diagnostic email. If you have allowed a diagnostic email to be sent, it will now include which version of osC_Sec you are using.
- Changed the whitelisting function to the perl compatible regular expression
- Added more blacklisted items to the form filtering ($_POST requests)
NOTE: For users upgrading from osC_Sec_2.5[r2] you only need replace the osc_sec.php with the one contained in this zip file.
Whats New?
- Shifted the timezone settings into the settings area. These determine the accuracy of the timestamp when an exploit attempt is detected. This will mean that you will have to update the settings file osc.php as well as the content file osc_sec.php (hopefully last time)
- Made the cleanup of the $_GET variables optional again due to conflicts with some addons. A setting has been added to osc.php called $GETcleanup. It is by default set to activated so no changes needed for most users.
- Removed surplus settings from osc.php which were no longer used
Whats New?
- IMPORTANT: osC_Sec is now split into two files (thanks to a suggestion by Grakkam) osc.php which contains the settings, and the rest is in osc_sec.php. So from now onward updating will mean simply overwriting the osc_sec.php file which contains the actual code.
- removed the SSL code from osC_Sec as it is no longer needed and as someone else pointed out, there is already an addon that deals with SSL issues.
- updated the way osC_Sec determines SSL (thanks to germ)
Whats New?
- Just a quick fix on several commented out bits that shouldn't have been. Full package contained.
Whats new?
- improved the way the phpSelf function checks for faulty $PHP_SELF results
- fixed issues with the banning of directly viewing osC_Sec.php
Whats New?
- fixed write access message so that it no longer displays the root path on install
- added a whitelist for IP addresses to protect from accidentally banning 3rd party payment callbacks like Paypal
- added more blacklist items
- developed out method 2 of the php_self check
Whats New?
- added blacklist items
- improved whitelist filtering of multimensional arrays
Whats new?
- Updated black listing items
Whats New?
- Fixed a bug where redirect addons resulted in site visitors being banned.
Whats new?
- fixed bug in $_GET whitelisting
- added black list items to block XSS attempts
Whats New?
- Osc_Sec now blocking the null byte injection
- Fix reporting errors with IIS and REQUEST_URI
- Cleanup to remove unused code
- Improved GET whitelist
Whats New?
- optional automatic email notification to the developer ( see readme.htm for more )
- further improvements to the way osc_sec handles multidimentional arrays
- improved blacklist items
Whats New?
- Further corrections to the filtering of base64 encoded variables.
Whats New?
- Fixed a couple of issues with the base_64 decode filter which caught 3rd party payment systems that use base64 encoded variables.
Osc_Sec_2.3[r8]
Whats New?
- Some sections of osc_sec.php are now permanently activated, whilst others remain optional (see readme.htm).
- a bug has been fixed in the base_64 decode feature.
- more black list terms have been added
- blacklisted terms have been separated out from those specifically for POST, GET and the rest are filtered at REQUEST
As there is a significant amount of rearranging going on with this release, please take time to read the readme.htm again if you are upgrading.
Whats New?
- Some sections of osc_sec.php are not permanently activated, whilst others remain optional (see readme.htm).
- a bug has been fixed in the base_64 decode feature.
- more black list terms have been added
- blacklisted terms have been separated out from those specifically for POST, GET and the rest are filtered at REQUEST
As there is a significant amount of rearranging going on with this release, please take time to read the readme.htm again if you are upgrading.
Whats new
- Added Base64_Decode section for post data
- REQUEST filtering
- Removed ban message in browser
- Fixed bug in hexcode filter
- Added more items to the blacklists
Osc_Sec_2.3[r6] updated
Whats new?
- added a few more black listed strings to the POST and GET list to pick up attempts to activate exploits.
Osc_sec_2.3[r5] updated
Whats New?
- Added a PHP 4.x friendly function to emulate PHP 5.x http_build_query(). This will allow the POST blacklisting, $arbitrarysession_block and Hexvars filtering work on PHP 4.x servers. Thanks to Steve Skinner of Digistore for bringing this to my attention.
Whats new:
- fixed several bugs where n were without quotes.
- improved the way IP Trap function deals with different configurations
Whats New:
- Osc_Sec htaccess banning is now more compatible with earlier versions of PHP.
- Support for the way in which Osc_Sec writes to htaccess is now removed for ms windows based apache servers (this only affects the way in which htaccess files are written).
- Further update to the whitelisting to report correctly
Whats new:
- Tweaked the whitelisting some more to allow for '?' and '='.
- Sorted a small bug in the way the email notification is reporting.
- Fixed an error in the preg_replace whitelisting that was not allowing for "?" in URLs. Thanks to ptt81 and benjjj6 for pointing this out.
Sorry about that, uploaded the wrong file in the previous version.
2.2[r8]
- added the ability to urldecode post variables to check them against the blacklist
- new phpSelf function to keep the PHP_SELF reporting correctly
Whats new in 2.2[R7]
- Added in a check into the XSS filter that first checks if $getvariables is not an empty array
- Added in an extra filter to catch attempts to POST worm code into files. This will only work
- on files that call application_top.php
- Osc_sec now automatically determines whether it is running on a windows based apache server or not.
Whats new in 2.2[R6]
- Added more items to the $oscsec_getVar_blacklist
- Removed method 3 to find the correct PHP_SELF
- Fixed a bug in where the string length was not checked (thanks to wallaceyap for pointing this out)
Whats new in 2.2[R5]
- Added 'String.fromCharCode' to the POST blacklist
- Did some more work on the way Osc_Sec deals with hex code in post strings.
- Changed the query strings XSS filter to be PHP 4.x compatable.
- Back to the drawing board for the is_writable issue.
Whats new in 2.2[R4]
- Changed is_writable() to a new function hCoreFileChk()
- Removed the ban for PHP_SELF options 2 and 3. These are experimental and are there for logging purposes only.
- Added HEAD to the whitelist requests list
- Removed 'javascript' and '%3Cscript' from the POST blacklist as this was causing accidental self bans when an admin added javascript code to custom pages.
Whats new in 2.2[r3]
- Added another layer of protection to combat non-standard request forging. See the readme.htm for more on this issue.
- Added a ban message to let the attacker know why they were banned (for those using htaccess).
- Tidied up the messaging in the email notification
Whats new in 2.2[r2]
- Corrected the way in which banned ips are added to htaccess
- Fixed the PHP_SELF replacement code in the readme.htm (Thanks to Mikko)
Whats new in 2.2[R1]
- Fixed up errors in the email notification concerning carriage returns.
- Added the osc_sec version into the email notification to assist with debugging and support for users
- Changed $arbitrarysession_block to 0 for default installations of osc_sec.php
Whats new in 2.1[R9]
- Removed <LIMIT GET POST> from htaccess due to it is vulnerable to being bypassed.
For previous users of osc_sec.php this will cause a new list of IP addresses to build in your .htaccess file but should not cause any problems to do so.
If you like you can manually migrate the list of banned IPs from the old list to the new one but it will not hurt to leave them as they are.
Preferably though it is best not to encapsulate the order,allow,deny within the <LIMIT GET POST> directive as this can be quite easily bypassed.
If anyone needs assistance in migrating lists please feel free to email me at rohepotae@gmail.com
Whats new in 2.1[R8]
- A general cleanup of the code.
- A new readme.htm file (in the zip file)
- Fine tuned the way osc_sec.php selects between htaccess, IP Trap and calling a page die()
- If IP Trap is called and IP address is already in the banned list then osc_sec now redirects banned IP addresses to blocked.php
- Improved the way $forceHTTPS works
Whats new in 2.1[R7]
- Removed the new setPhpSelf function due to it was reporting incorrectly in some circumstances during Paypal transaction callback.
IMPORTANT: If you are using version 2.1[r6] and use Paypal as a payment option then please update
Whats new in 2.1[R6]
- Email notification now has a printout of $_GET
- Added in FWRs PHP_SELF function
Whats new in 2.1 [R5]
- Added several other methods of attaining a correct $PHP_SELF
- If $PHP_SELF incorrect then a ban is now called
- Added a new blacklist item to filterGETRequests
Whats new in 2.1 [R4]
- Fixed a small bug in the email code attempting to print each server variable as a string rather than checking first to see if the var wasn't actually an array (thanks again to ptt81 for the heads up).
Whats new in 2.1 [R3]
- Added in a new function to look for malicious hex code in both query strings and post data. Now hex versions of each blacklisted item are checked for in post and get variables, if found, are banned.
Whats new in 2.1 [R2]
- Email notification now contains the complete array of POST and SERVER
- Email notification long data trimmed
- Email notification data filtered
Whats new in 2.1 [R1]
- Rewrote black lists into arrays
- Fixed error in unset code
- Added more blacklist items targeting spam bot POST attempts to place eval code onto a vulnerable website
Whats new in 2.0 [R9]
- After observing some intruders in progress it has become evident that
they are able to post eval base64_decode code into various php pages
of sites that have been previously attacked while vulnerable to the admin
exploit. So I have added base64_decode to the list of blacklisted form
and query inputs.
Whats new in 2.0 [R8]
- Removed $testPHPDosBug and $filterBase64_Code sections to lighten the load (might make a stand alone for those two, but they do not really need to be in osc_sec.php)
- Added in $chkPostLocation which is an attempt to thwart remote posting
- Removed the serializing of variables to make email notification more readable.
Whats new in 2.0 R7
- Better handling of server configurations concerning https
- Added in clean up array functions (osc_sec_array_cleaner) for GET and POST operations
- Added extra cleanups for $_REQUEST
- Added globals cleaner
Just a minor fix of 2.0.5
Whats new in 2.0.5
- Clean up of the way osc_sec prints the email notification.
This time with the correct settings (ignore last entry this is the latest)
Whats new in 2.0.4
- Clean up of the way some versions of Oscommerce handle sessions.
- An all round cleanup of code below.
- Rearranged into groups based on GET, POST, COOKIES and MISC
Just a bug fix.
Removed a bad idea from $filterGETRequests so now admins are not automatically banned when trying to log in. :-/
Whats new in 2.0.2
- Fixed the way osc_sec reports via email
- Removed the usu5 function and replaced it with the PHP_SELF fix from osc2.3.1
- Updated the instructions above accordingly
- Added a check for the PHP DoS bug in a browsers referer and user-agent
Whats new in 2.0.1
- Changed the $filterGETRequests conditions to allow for fake admin folders.
- Fixed the $safeServerReqURI bug, thanks again to ptt81
- Changed the name of the usu5_base_filename to usu5_base_filename_osc_sec to not clash with
some versions of oscommerce that may have half implimenting the PHP_SELF fix
- Updated to the latest usu5_base_filename function (see: http://tinyurl.com/usu5-base-filename)
- Fixed the way the email notification deals with the HTTP Referer
Whats new in Osc_Sec 2.0
- Now allows $testPHPDosBug_POST to optionally ban or filter form values
- Now only allows a safe serialized float string to appear in the email notification
- Removed white spaces from IP Trap ban list
- Does a better clean up of IP TRAP.txt
- Cleaned up the way POST variables are filtered
- Fine tuned the $testExpiredCookie function
- Updated the phpSelfFix code to the latest USU5 function
- Added in another method of picking up attack attempts on the admin folder
More of a maintenance update.
Whats new in 1.1.6
- Big fix up of the $testPHPDosBug code
- Added in a the full list of float numbers that are affected
- Changed the way the $testExpiredCookie interacts with OSC cookies.
Fixes the cookie reporting to make it work better. Still more work needed to be done on this area. A serialized copy of the cookies are intended to be appended to the email notification of a ban.
Whats new in 1.1.3
- Stitches up this problem at http://bugs.php.net/bug.php?id=53632, switch $testPHPDosBug
from 0 to 1 to activate it.
- Added a record of the cookies into the email notification
Whats new in 1.1.2
- Added IP resolve URL in the email notification for banned emails.
- Removed the test ban function as it was catching legitimate requests
- Added a ban for the unlogged in backup exploit
ver 1.1.1
Fixed an error in the way osc_sec writes to the IP Trap text file.
Thanks again to ptt81 for pointing out an error in the way Osc_Sec appended IP addresses to IP Trap.
Ver 1.1.0 also allows email notifications on an IP Trap ban as well, along with a number of small fixes.
I have also added a test section which will call a ban on any URL that is called that contains the word "banned". This could be problematic for anyone whose website just happens to use that word legitimately.
If so, scroll down through Osc_Sec and comment out that section, its just there for testing purposes.
On the other hand if you do not ever call that word within a URL, then you can also use it to redirect to, in order to invoke a ban. In particular using htaccess to block access to folders.
This update has fixed a few bugs (thanks to ptt81) and has a few additions to it.
The major additions are the ability to integrate into the IP Trap addon, and also a test function which looks for rogue base64 code within arrays. When I say test, I mean just that. The best way to deal with rogue base 64 is to not allow attackers access to your website in the first place.
Anyways, any feedback much appreciated thanks.
A security script design as a workaround for the following common security holes.
http://www.exploit-db.com/exploits/15472/
http://www.securityfocus.com/bid/9211/exploit
http://tinyurl.com/osc-hack3
http://www.exploit-db.com/exploits/15472/
http://www.exploit-db.com/exploits/15128/
Also allows (optional) options to ban a range of dictionary hammering applications that do not understand cookies.
Has a function to add IP addresses automatically to a banned list htaccess file if the user breaks the rules.
Note: Contributions are used at own risk.
osC_Sec 5 [final]
osC_Sec 4.2[r8]